Improvement of continuous-variable quantum key distribution systems by using 

optical preamplifiers 



00 
O 

o 

O 

Q 

(N 

a,; 

^— > ■ 



> 
m 

oo 

o 



X 



S Fossier 1,2 , E Diamanti 2 , T Debuisschert 1 , R Tualle-Brouri 2 and P Grangier 2 
1 Thales Research & Technology France, RD 128, 91767 Palaiseau Cedex, France and 
2 Laboratoire Charles Fabry de I'Institut d'Optique - CNRS - Univ. Paris-Sud, 
Campus Poly technique, RD 128, 91127 Palaiseau Cedex, France 

Continuous-variable quantum key distribution protocols, based on Gaussian modulation of the 
quadratures of coherent states, have been implemented in recent experiments. A present limitation 
of such systems is the finite efficiency of the detectors, which can in principle be compensated for 
by the use of classical optical preamplifiers. Here we study this possibility in detail, by deriving the 
modified secret key generation rates when an optical parametric amplifier is placed at the output 
of the quantum channel. After presenting a general set of security proofs, we show that the use 
of preamplifiers does compensate for all the imperfections of the detectors when the amplifier is 
optimal in terms of gain and noise. Imperfect amplifiers can also enhance the system performance, 
under conditions which are generally satisfied in practice. 



I. INTRODUCTION 

Continuous-variable quantum key distribution 
(CVQKD) has been proposed in the past few years as 
a promising alternative to the most commonly imple- 
mented discrete- variable QKD. The CVQKD approach 
has two main advantages: first, it avoids the limitations 
associated with single photon counting, and second, it 
offers the prospect of very high rate secure key distri- 
bution. Whereas discrete-variable protocols encode the 
key information in properties of single photon pulses [l[ , 
CVQKD protocols use for the same purpose optical 
variables that can take a continuous range of values, 
such as the quadratures of a mode of the electromagnetic 
field. The different CVQKD protocols can be roughly 
categorized by the type of states, modulation, detection 
system and error-correction algorithm they are employ- 
ing 0, H, H, H, H, 0| ■ Here we are interested in protocols 
where Alice encodes the key information by modulating 
the quadratures x and p of few-photon coherent states 
with a centred Gaussian distribution @, 1, E3. At 
the receiver's site, Bob measures either one of the two 
quadratures randomly using homodyne detection @, Q, 
or both quadratures simultaneously with heterodyne 
detection, thus avoiding the need for random basis 
switching [lfj. In the final step of the protocol, Alice 
and Bob apply a reconciliation procedure to form a 
secret binary key from the continuous information they 
share. 

The security of the Gaussian CVQKD protocol with 
homodyne detection was first proven against individ- 
ual Gaussian eavesdropping attacks, using either di- 
rect or reverse [1] reconciliation. Security proofs were 
then obtained against general individual or finite-size at- 
tacks [lli > and general collective attacks [H, 0, [3] • For 
the protocol with heterodyne detection, the first bounds 
of Eve's accessible information in the case of individual 
Gaussian attacks were provided in [10Lll5l] . and were later 
improved in [l6|, [l7| . while the case of collective attacks 
was analyzed in [18j |. Recently, the unconditional secu- 



rity of both homodyne and heterodyne protocols has also 
been proven 

The theoretical security for systems implementing 
CVQKD protocols has therefore been proven to be max- 
imal, and is not degraded by the inherent imperfections 
of Bob's detector, such as noise and inefficiency, that are 
present in practical CVQKD systems. These imperfec- 
tions, however, degrade the generation rate of the final 
secret key. A possible way to overcome this limitation is 
to use optical parametric amplifiers to boost the signal 
just before detection, thus compensating at least par- 
tially for detector losses [201 ] . as has been demonstrated 
experimentally, for example in [U H2] • In the context of 
quantum cryptography [3, 0] , we therefore need to eval- 
uate in what way the expected improvement in effective 
quantum efficiency translates into an improvement in se- 
cret key generation rate, based on the security proofs 
mentioned above. 

In this paper, we propose to insert an amplifier at the 
output of the quantum channel and inside Bob's appara- 
tus, and we calculate the resulting secret key generation 
rate for different cases of eavesdropping attacks. For this 
purpose, we assume that Bob's apparatus is inaccessible 
to the eavesdropper, Eve. This assumption is consistent 
with the idea that if Eve could indeed have access to 
Bob's setup, then she would also have access to classical 
data storage, or could impersonate Bob, and the secu- 
rity of the entire communication would be compromised. 
Since such a situation is unacceptable for a real system, 
we perform calculations under the "realistic" assumption 
that the eavesdropper cannot benefit from Bob's system 
imperfections. 

The paper is organized as follows: In section [Til we 
review the expressions of the secret key generation rate 
for the homodyne protocol, and we derive corresponding 
expressions for the heterodyne protocol under realistic as- 
sumptions, in the case of a standard continuous- variable 
QKD system with no amplifier. In section [TTTI we add in 
the system an optical parametric amplifier placed at the 
output of the quantum channel, and derive the modified 
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secret key generation rates for the homodyne and hetero- 
dyne CVQKD protocols, and for both individual and col- 
lective attacks. Finally, we compare the performance of 
practical systems implementing these protocols for differ- 
ent configurations. In general we find that choosing the 
appropriate combination of detector and amplifier allows 
us to compensate for all the inherent imperfections of a 
practical detector if the amplifier has a minimal noise. 
We also show that a realistic noisy amplifier can also be 
employed, as long as the noise of the amplifier is small rel- 
ative to the noise and inefficiency of the detector, which 
is generally the case in practice. 



II. SECRET KEY DISTRIBUTION RATES FOR 
GAUSSIAN CVQKD PROTOCOLS 

In the following, we first review the basic notions re- 
lated to continuous-variable QKD protocols with Gaus- 
sian modulation and present the assumptions of our cal- 
culations. We then derive the expressions of the secret 
key generation rate for these protocols when homodyne 
or heterodyne detectors are used, and for the case of in- 
dividual or collective eavesdropping attacks. The tools 
that we present here will be essential for the calculations 
in the next section, which take into account the use of 
amplifiers to compensate for detector imperfections and 
thus enhance the performance of CVQKD systems. 



A. Notations and assumptions 

The standard prepare-and-measure description of the 
CVQKD protocol with Gaussian modulation of coherent 
states was briefly presented in the introduction. In more 
detail, the quantum transmission phase of the communi- 
cation between Alice and Bob is described as follows: 

• For each generated pulse, Alice randomly chooses 
two values for the in-phase quadrature x A and the 
orthogonal quadrature p A from a Gaussian distri- 
bution centred at zero and of variance V a Nq, where 
No is the shot noise variance. She then prepares a 
coherent state centred at (x A ,p A ) and sends it to 
Bob through the quantum channel. The channel 
features a transmission efficiency T and an excess 
noise e, resulting in a noise variance at Bob's in- 
put of (I + Te)Nq. The total channel-added noise 
referred to the channel input, expressed in shot 
noise units, is defined as x linc = (I + Te)/T — I = 
1/T-l + e. 

• When Bob receives the modulated coherent state, 
he measures either one of the two quadratures ran- 
domly (homodyne case) or both quadratures simul- 
taneously (heterodyne case). A practical detec- 
tor is characterized by an efficiency r\ and a noise 
i> ol due to detector electronics. As we did for the 



channel, we can define a detection-added noise re- 
ferred to Bob's input and expressed in shot-noise 
units that we denote in general as % h , and is given 
by the expressions x hmn = [(I — rj) + v^/rj and 
Xhot = [f + (f — v) + 2w i]/?7 f° r homodyne and 
heterodyne detection, respectively. The total noise 
referred to the channel input can then be expressed 
as Xtot = Ximo + Xb/T. 

The prepare-and-measure description presented above 
is equivalent to the entanglement-based scheme shown 
in figure [TJ This equivalence is at the heart of security 
proofs for this type of CVQKD protocols and has been 
explained in detail in [3, [H, HH. In this scheme: 

• The coherent state preparation by Alice is mod- 
eled by a heterodyne measurement of one half of 
a two-mode squeezed vacuum (EPR) state of vari- 
ance V = V A + 1. The other half of the EPR state 
is sent to Bob through the quantum channel. 

• Bob's detector inefficiency is modeled by a beam- 
splitter with transmission 77, while its electronic 
noise v el is modeled by an EPR state of variance 
v, one half of which is entering the second input 
port of the beamsplitter, as shown in figure [TJ The 
variance v is chosen to obtain the appropriate ex- 
pression of Xhi m f ne following way: for homodyne 
detection, v = T]Xham/ (1 — v) = 1 + w ei/(l — ??), an d 
for heterodyne detection, v — (rjXhat — 1)/(1 — 77) = 
I + 2v cl /(l — ?;), where the I in the numerator 
(^Xhot — f ) of the last expression is subtracted due 
to the unit of shot noise already introduced by the 
heterodyne detection. 

Once the quantum transmission phase of the commu- 
nication has ended, Alice and Bob proceed with classical 
data processing procedures, which include a reconcilia- 
tion algorithm to extract an identical chain of bits from 
their correlated continuous data, and a standard privacy 
amplification process to derive a final secret key from this 
chain. The reconciliation is direct when Alice's data is 
used as a reference for establishing the key and reverse 
when the reference is Bob's data. Reverse reconciliation 
has been shown to offer a great advantage in QKD sys- 
tem performance Q, therefore calculations in this paper 
have been performed for this case. Direct reconciliation 
expressions can be derived using similar tools as the ones 
presented here. 

Under the assumptions that we have described, we 
want to calculate the secret key generation rates for the 
Gaussian coherent-state CVQKD protocol with homo- 
dyne and heterodyne detection, for the case of individual 
and collective eavesdropping attacks. These are consid- 
ered to be Gaussian attacks, which have been shown to 
be optimal [l2|, [l3| . In the case of individual attacks, Eve 
is authorized to interact individually with each coherent- 
state pulse sent by Alice, store her ancillae in a quantum 
memory, and perform measurements on them after sift- 
ing (for example, in the case of homodyne detection, after 
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Bob has revealed the quadrature he chose to measure), 
but before the reconciliation phase. In the case of col- 
lective attacks, Eve interacts individually with each pulse 
but is allowed to wait for the entire classical procedure to 
end before performing the best possible collective mea- 
surement on her ensemble of stored ancillae. The maxi- 
mum information on Bob's key available to Eve is limited 
by the Shannon bound I BE [24 . 2511 for individual attacks 
and by the Holevo bound Xbe [26[ for collective attacks. 
In the following, we will derive expressions for I BE and 
Xb E as a function of system parameters. Then, from an 
information-theoretic perspective, the secret key infor- 
mation that Alice and Bob can distill is defined, in the 
case of reverse reconciliation, as A/ Shannon = J AB — I BE for 
individual and A/ H oicvo = Iab — Xbe for collective attacks, 
where 7 AB is the information shared between Alice and 
Bob. 

It is important to note that the security of the CVQKD 
protocols against coherent attacks has recently been 
proven Coherent attacks are the most powerful at- 
tacks allowed by quantum mechanics. They allow Eve 
to interact collectively with all the pulses sent by Alice 
and perform joint measurements on her ancillae after the 
entire quantum and classical communication. The secu- 
rity proofs show that the derived bounds for the secret 
key generation rate in the case of collective attacks re- 
main asymptotically valid for arbitrary coherent attacks. 
Therefore, the results that we derive in the following sec- 
tions for collective attacks are valid for coherent attacks 
as well, guaranteeing the unconditional security of the 
corresponding QKD systems. 
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where here V B = r]T(V + Xtot )/2, V B \ A = r)T(l + Xtot )/2, 
and x tot takes the appropriate expression for heterodyne 
detection ( section [II Al) . 

The information that Eve gains on Bob's data given 
that both quadratures are measured is given by I BE = 
log 2 (pB/V^i E )- A bound on V B \ E when Eve is allowed 
to have access to Bob's setup has been calculated in [if 

It is given by the expression V B \ B - 

where x E = T(2 - e) 2 /(V2 - 2T + Te + y/e)' z + 1 M 

To extend this bound to a more realistic scenario, we 
need to take into account the fact that the detection is 
not accessible to Eve, and only adds noise that is not 
correlated to the signal. The corresponding signal-noise 
commutators are therefore all zero, and the calculation 
is equivalent to correcting the various variances that in- 
tervene in the expressions, to account for the detection 

parameters. We then find V B \ E = rj ( y 3 ^ 1 + X^J A 

where x E is the same as above. Putting things together, 
Eve's information is in this case given by the following 
expression: 



= log 2 



= log 2 



T(V + Xtot )(V + x E ) 

VX E + 1 + Xhet(V + 



(4) 



The Shannon secret key generation rate A/^^ 
calculated from © and JU). 



is then 



B. Individual attacks 



Collective attacks 



Homodyne detection case: The mutual informa- 
tion of Alice and Bob, / AB , is derived from Bob's mea- 
sured variance V B = rjT(V + Xtat) and the conditional 
variance V B u — i]T(l + Xtot ) using Shannon's equation: 



i, v B 
2 log2 V7 



1, V + Xtot 
2 1 + Xtot 



(1) 



Eve's information on Bob's measured quadrature, I BE , 
is also derived using Shannon's equation in the case of 
individual attacks [111 ]. For reverse reconciliation and 
under the assumption that Eve cannot benefit from the 



detection-added noise, Vb| e = n 
and therefore UM 



T(l/V+ Xlinc ) + Xhox 



V B _ T\V + Xtot )(l/V + Xl ^) 
l + Tx h o,„(l/^ + Xnno) 



V B 



(2) 



The Shannon secret key generation rate is then given by 

"'Shannon AB J BE 1 

Heterodyne detection case: It is straightforward 
to derive the mutual information of Alice and Bob for 



For convenience, we consider in this section the ho- 
modyne and heterodyne cases in parallel. The mutual 
information between Alice and Bob is given in the case 
of collective attacks by the same expressions as for in- 
dividual attacks, namely |T]) and Q for homodyne and 
heterodyne detection, respectively. Deriving Eve's infor- 
mation on Bob's measurements, on the other hand, re- 
quires a different approach that has been developed in 
detail in [14), [l8| for the homodyne detection case. Below 
we present the main ideas of this technique and extend 
it to the heterodyne detection case. 

The maximum information available to Eve on Bob's 
key is bounded by the Holevo quantity (2?| 



Xbe = S(p E ) - / dm B p(m B ) S(p™ B ) 



(5) 



where tti b represents the measurement of Bob, and it can 
take the form m B — x B (d77i B — ds? B ) for a homodyne 
detector or the form m B = x B ,p B (dm B = dx B dp B ) for 
a heterodyne detector. Also, p(m B ) is the probability 
density of the measurement, p" lB is the eavesdropper's 
state conditional on Bob's measurement result, and S is 
the Von Neumann entropy of the quantum state p. 
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FIG. 1: Entanglement-based scheme of a Gaussian coherent-state CVQKD protocol with homodyne or heterodyne detection. 
The transmission T and channel-added noise Xune are controlled by Eve, who however does not have access to Bob's detection 
apparatus. 



Using the fact that Eve's system purifies the system 
ABi, that Bob's measurement purifies the system AEFG 
(see figure[T]for mode notation), and that S(p™™g) is inde- 
pendent of m B for Gaussian protocols, Xbb becomes [l4| : 



(6) 



Since it has been shown that Gaussian attacks are opti- 
mal for collective attacks [HI, [l3| , it is enough to consider 
Gaussian states, in which case the expressions for the en- 
tropies can be further simplified as follows: 



-Eg 



Ai-l 



5 

£ 

i=3 



G 



Ai-l 



(7) 



where G(x) — (x + l)log 2 (a; + 1) — xlog 2 a;, Ai,2 are 
the symplectic eigenvalues of the covariance matrix 7 A bi 
characterizing the state p ABl , and As^.s are the symplec- 
tic eigenvalues of the covariance matrix 7^^ character- 
izing the state p™£. after Bob's projective measurement. 

The covariance matrix 7 ABl only depends on the sys- 
tem including Alice and the quantum channel, therefore 
the first part of {7} is the same for the homodyne and 
heterodyne cases. The matrix is written as 



7a 



7a 

Cabi 



ABi 
7B! 

V ■ to 



(8) 



VW 2 



^T(V 2 -l)-a z T(V + Xune )-l 2 



where t 2 is the 2x2 identity matrix and o~ z = 



1 

-1 



The symplectic eigenvalues A1.2 > 1 of the above matrix 
are given by 



\ 2 

A l,2 



1 r 



A ± \J A 2 - AB 



with 



(9) 



A = V 2 {l-2T) + 2T + T 2 {V + X v^f 
B = T 2 (Uxn»c + l) 2 



To calculate the second part of |(7J), we need to find 
the symplectic eigenvalues of the covariance matrix 7^^, , 



which can be written as 



7afg = 7afg 



t7 AFGB3^ <J AFGB 3 



(10) 



In the above equation, H is the symplectic matrix that 
represents the homodyne or heterodyne measurement on 
mode B 3 . In the former case, H hom = (A7 B3 X) MP , 
"10" 



where X — 







and MP stands for the Moore- 



Penrose pseudo-inverse of a matrix, while in the latter 
case, H hBt = {j B3 + 1 2 ) _1 0. The matrices 7 B3 , 7 AFG , 



and (7 a 



can all be derived from the decomposition of 



the covariance matrix: 



7. 



AFGB3 



7afg ^AFGBs 
Cafgb 3 7b 3 



(11) 



The above matrix can be derived with appropriate rear- 
rangement of lines and columns from the matrix describ- 
ing the system AB3FG (figure [J): 



7AB3FG = (y BS ) J [7AB 1 ©7F G]^ E 



(12) 



Here, 7 ABl (= 7ab 2 ) is given in ©, while 7 FoG is the ma- 
trix that describes the EPR state of variance v used to 
model the detector's electronic noise. It is written as 



7f g 



V-U \/W - 1) • <Tz 

P-l)-a z vt 2 



(13) 



where v takes the appropriate value for the homodyne or 
heterodyne detection case (section fll A|) . Finally, the ma- 
trix F BS describes the beamsplitter transformation that 
models the inefficiency of the detector and acts on modes 
B 2 and Fq. It is given by the expression: 



Y BS = 1. 



1 G , with 



(14) 



-y^BS 

B 2 F 



We now have all the elements required to proceed to 
the calculation of the symplectic eigenvalues A3,4 ; 5. For 
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both homodyne and heterodyne cases, we find that the 
eigenvalues A3. 4 > 1 are given by expressions of the form 



\ 2 

A 3,4 



1 



C ± \/C 2 - 4£> 



where for the homodyne case 

A Xhom + y + r(v + xu») 



0» 



(15) 



(16) 



and for the heterodyne case, 
1 



C ho t 



[A X L+B + 1+ 



+2xUWb + T(V + X u M )) + 2T(V 2 - 1) 



(17) 



where A, B are given in ^ . The last symplectic eigen- 
value is A 5 = 1 for both cases. Based on Q, ©, 
(fl~5|) . (fTB"|) . and (fTF)) , we calculate the Holevo information 
bound Xbe and thus derive the Holevo secret key genera- 



tion rate AK 



1 in 



■Xlr and AJ£S ev 



That ~,ixet 

ab Abe 



for homodyne and heterodyne detection, respectively. 



III. ADDING AN AMPLIFIER TO 
COMPENSATE FOR DETECTOR 
IMPERFECTIONS 

In the practical case that we are considering, where 
Bob's detection apparatus has inherent imperfections 
that degrade the secret key generation rate, it is impor- 
tant to consider ways of overcoming this limitation by 
compensating for these imperfections. To this end, the 
use of optical parametric amplifiers, practical and thor- 
oughly studied devices, appears as a natural choice 
Under the realistic assumption that the amplifier is not 
available to the eavesdropper, its use can allow Bob to 
compensate fully or partially for the losses that occur 
after the output of the amplifier, and thus enhance the 
system performance in terms of secret key distribution 
rate and maximal communication distance. 

In the following, we first provide models for two types 
of classical amplifiers and then combine these models 
with the calculations of section |TT] to derive the modified 
secret key generation rates for Gaussian coherent-state 
CVQKD protocols with homodyne and heterodyne de- 
tection, and for individual and collective eavesdropping 
attacks, when a classical amplifier is placed at the input 
of Bob's apparatus. We also apply the results to practi- 
cal systems and compare their performance for detectors 
and amplifiers with different characteristics. 



A. Amplifier models 

Because of their importance for various technological 
applications including communication systems, optical 
amplifiers and their noise characteristics have been 
studied extensively [2§| , Here we consider two types 
of amplifiers, an ideal phase-sensitive amplifier and a 
practical phase-insensitive amplifier. 

Phase-sensitive amplifier: The phase-sensitive am- 
plifier (PSA) is a degenerate optical parametric ampli- 
fier that ideally permits noiseless amplification of a cho- 
sen quadrature. It is described by the transformations 
x s —>■ \fgxs, Ps Ps/yfg, where g > 1 is the gain of the 
amplification and x s , p s are the two quadratures of the 
signal mode. Therefore, the amplification process has an 
asymmetric effect on the quadratures, with the in-phase 
one being amplified and the orthogonal one squeezed. A 
realistic amplifier can also add noise to this process but 
this effect is neglected here. 

Modeling this type of amplifier for our purposes is 
straightforward. The model is shown in figure [2^a), 
where the mode notation refers to figure Q] 



Phase-insensitive amplifier: The phase-insensitive 
amplifier (PIA) is a non-degenerate optical paramet- 
ric amplifier, which is described by the transformations 

-> y/gxs + Vg - ig r , Ps -> y^Ps - Vg - lpi, and 

l^s, Pi -> y/gPi - Vg l Ps- Here, 



Xi -> ^/gxi + yjg- lxg, Pi -> y/gpi - yfg- 
g > 1 is again the gain of amplification, while S and I de- 
note the signal mode and an idler mode that is ideally in a 
vacuum state or, in a more realistic setting, in a state fea- 
turing a noise variance V[ — N > 1 (in shot-noise units). 
Therefore, this type of amplifier amplifies symmetrically 
both quadratures but the amplification process is asso- 
ciated with a fundamental excess noise that arises from 
the coupling of the signal input to the internal modes 



(a) 



Eve 



Bob 



(b) 



Eve 



EPR 



Bob 



FIG. 2: Model for (a) an ideal phase-sensitive and (b) a prac- 
tical phase-insensitive amplifier, placed at the output of the 
quantum channel and inside Bob's apparatus. 
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of the amplifier [28|, 129J . When these are in a vacuum 
state, N = 1 and the phase-insensitive amplifier adds a 
minimal noise for a given gain g. Such an amplifier can 
be approximated in practice using nonlinear processes in 
optical crystals [H, |3(| or doped optical fibres [3lJ . 

Figure E^b) shows the model for the phase- insensitive 
amplifier, ft consists of a noiseless amplifier that applies 
the appropriate gain factor to each input mode and an 
EPR state of variance N, one half of which is entering 
the amplifier's second input port, and which serves the 
purpose of modeling the amplifier's inherent noise. 



B. Modified secret key generation rates 

Considering the characteristics of the homodyne and 
heterodyne detectors on the one hand and of the phase- 
sensitive and phase-insensitive amplifiers on the other, it 
is natural to expect that certain configurations are better 
adapted than others. Indeed, the symmetrical ampli- 
fying effect of a phase-insensitive amplifier on the two 
quadratures of its input mode appears to be more suit- 
able for a heterodyne detector where both quadratures 
are measured, while the single measured quadrature of a 
homodyne detector can benefit from the ideally noiseless 
amplification induced by a phase-sensitive amplifier. We 
expect then that these two configurations can result 
in a significantly improved performance of the corre- 
sponding CVQKD systems. Consequently, we provide 
an analysis for these two cases in this section, leav- 
ing the other two possible combinations for the appendix. 

Homodyne detection and phase-sensitive ampli- 
fier case: We start our analysis with the case of col- 
lective attacks when the ideal phase-sensitive amplifier 
described before is inserted into a CVQKD system with 
homodyne detection. 

As we mentioned in section Til CI the information that 
Eve has gained on Bob's key is given by ([7]). The first 
part of this equation does not depend on Bob's setup, 
and therefore the results of © remain unchanged for all 
cases. For the second part of ([7]), we need to calculate 
the symplectic eigenvalues of the covariance matrix 7ff G . 
This calculation leads to the matrix 7 A b 3 fg of (jl2[) . which 
is now written as follows: 

7AB3FG = (Y BS ) T (Y rSA ) T llA Bl 8 7 Fo o]y PSA ^ BS (18) 

In the above equation, the matrices F BS , 7 ABl , 7foG are 
given in section III C[ while the matrix Y PSA describes 
the transformation induced on mode Bi by the phase- 
sensitive amplifier: 



-y^PSA 
Bl 



1 G , with (19) 



V9 
1/y/g 



It is now straightforward to derive the modified symplec- 
tic eigenvalues. We find that these are actually given 



again by the expressions of (fTSf . (fT6|) . with the only dif- 
ference that the detection-added noise Xhom (and conse- 
quently the total noise Xtat) is conveniently modified to 
include the effect of the amplifier: 



PSA 
Ahom 



(1 — 77) + v e 
gv 



(20) 



It is important to note that we have implicitly assumed 
that Bob always amplifies the quadrature that he has ran- 
domly chosen to measure: this is clearly advantageous for 
him, and in theory straightforward to achieve. However, 
this requires in practice to phase lock the optical beam 
pumping the amplifier and the local oscillator of the ho- 
modyne detection, which may not be easy to implement. 

Concerning the mutual information between Eve and 
Bob for the case of individual attacks, as well as the 
information shared between Alice and Bob, we find that 
the expressions of |T|) and {3J remain valid with Xhom 
and Xtot modified as in (|2"U|) . 

Heterodyne detection and phase-insensitive 
amplifier case: As with the previous case, we follow 
the analysis of section Hi CI for collective attacks, but for 
heterodyne detection and with a phase-insensitive ampli- 
fier placed at the output of the quantum channel. 

It is clear from figure [2jb) that in order to take into 
account the amplifier-added noise in this case, two addi- 
tional modes I and J need to be included in the calcu- 
lation. Then, \ BE is calculated from the following equa- 
tions that replace ([6]) and (UJ: 



Xbe — S(p ABl ) <5(Pa?jfg) 

i=l V / i=3 



E G 



(21) 
(22) 



It is therefore necessary to derive the symplectic eigen- 
values of the 5-mode covariance matrix 7aufg 1 which in- 
volves the solution of a polynomial of degree 5. Proceed- 
ing as in section III CI we write 



ZB,PB _ 
IaIJFG — /AIJFG 



My. 



(23) 



where H hct = (7 B3 + B^) -1 - The identity matrix in this 
expression represents the beamsplitter included in the 
heterodyne detector. As in (fTTjl . the matrices in this 
equation can be derived from the decomposition of the 
matrix 7 A ufgb 3 > which can in its turn be derived by first 
calculating the matrix (see figures Q] and [2fb) for mode 
notation) 



7ab 2 up g = {Y PIA Y [ 7abi ® 7loJ 8 7f g]^ p 



(24) 



then rearranging it to obtain 7ab 2 f ugj an d finally calcu- 
lating 



7ab 3 fijg — (Y S ) 7ab 2 f i.ig^ 



(25) 



to obtain the desired result by a last rearrangement 
of matrix lines and columns. In the above equations, 
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7ab! and 7 PqG are known from (JSJ) and (|13p. while the 
beamsplitter transformation is now written as F BS = 
1a © ^b B 2 fo © li © 1j © 1q to account for the new modes. 
Furthermore, the matrix 7 IqJ describes the EPR state of 
variance N used to model the amplifier's inherent noise, 
and is written as 
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7i .j 



N • 1_ 2 \fN 2 - 1 • a z 
l-<Jz N-l 2 



(26) 



Finally, the transformation induced by the phase- 
insensitive amplifier on modes Bi and Io is described by 
the matrix: 



yPiA = t 



vpia 

Bil 



vpia 

Bll 



1f 



Ij © 

Vg ■ I 2 \fg - 1 • cr 

V5- 1 ' CT * y/9 ■ I2 



1 G , with (27) 



Based on the above additional elements, a rather com- 
plicated but straightforward calculation leads to the ex- 
pressions of (fT5]) . (fT7|) for the symplectic eigenvalues A 3 , 4 , 
while A5 6 7 = 1. Similarly to the case of homodyne 
detection with a phase-sensitive amplifier, the effect of 
the phase-insensitive amplifier can be incorporated into 
a modified heterodyne detection-added noise: 



PIA 
Ahct 



1 + (1 - 7?) + 2v cl + N(g - 1)?? 
9V 



(28) 



For individual attacks, as in the previous case, the 
Shannon expressions of ([3|) and ((4J remain the same with 
Xhot and Xtot modified as in 



C. Application to practical systems 

In this section, we apply the results derived in sec- 
tion [IBB] to practical QKD systems in order to compare 
their performance for different configurations. In par- 
ticular, we calculate the secret key generation rate as a 
function of distance for fibre-optic implementations of the 
Gaussian coherent-state CVQKD protocol, for individual 
or collective eavesdropping attacks, in two possible con- 
figurations: homodyne detection with a phase-sensitive 
amplifier placed at the output of the quantum channel, 
and heterodyne detection with a phase-insensitive ampli- 
fier included in the system. The remaining two detector- 
amplifier configurations are discussed in the appendix. 

The parameters that intervene in the equations that 
we derived in the previous sections are the variance of 
Alice's modulation V A , the transmission efficiency T and 
excess noise e of the quantum channel, the efficiency r\ 
and electronic noise v ol of the detector, the gain g and 
potentially the noise N of the amplifier. The parame- 
ters e, 77, and u el are fixed in all simulations to the values 
e = 0.005 (in shot-noise units), 77 = 0.6, and v el — 0.05 (in 
shot-noise units), which are standard in CVQKD exper- 
iments [TiJ]. The gain of the amplifier g takes the values 
1 (equivalent to no amplifier), 3, or 20, while we set the 



Collective attacks Individual attacks 

io° L 
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Distance (km) 



FIG. 3: Secret key generation rate as a function of distance 
for a protocol with homodyne detection and a phase-sensitive 
amplifier, in the case of collective (main figure) and individ- 
ual (inset) eavesdropping attacks. The 'perfect' curve corre- 
sponds to a perfect homodyne detector (77 = 1, v e i = 0) and 
no amplifier. 



noise of the phase-insensitive amplifier N to either 1 for 
minimal (vacuum) noise, or to the more realistic value 
1.5 (in shot-noise units, referred to the input). Further- 
more, the channel transmission efficiency is written as 
T = 10- Qi / 10 , where a = 0.2 dB/km is the loss coeffi- 
cient of optical fibres, and L is the length of the channel, 
as a function of which we calculate the secret key gener- 
ation rate. Finally, the modulation variance V A is linked 
to the signal-to-noise ratio (SNR) via Shannon's equation 
as follows: 



ilog 2 (l + SNR) = ilog 2 -^ 



At 



(29) 



1 



V A 



1 + Xt. 



Xtot 

F A = SNR(l + Xtot ) 



In the following simulations, we use the SNR as an 
adjustable parameter, with respect to which we numer- 
ically optimize the secret key generation rate for each 
distance. In this way, we find for each channel length 
the optimal modulation variance that maximizes the rate 
given specific system parameters. This optimization is 
easy to achieve in practical systems because it is in gen- 
eral straightforward to dynamically adjust V A . The SNR 
range used for the optimization is [0.5;15], which corre- 
sponds to values that can be easily reached in practical 
systems. 

In addition to the parameters mentioned above, we also 
take into account the fact that the reconciliation phase 
of the QKD protocol has in practical systems a finite 
efficiency. This effect is typically included using a recon- 
ciliation efficiency parameter that degrades in all cases 
the secret key generation rate as AJ Shannon = f3I AB — I BE , 
or A/hoicvo = (3Iab — Xbe- Our empirical work has shown 
that the maximal practically attainable (3 depends on the 
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FIG. 4: Secret key generation rate as a function of distance for 
a protocol with heterodyne detection and a phase-insensitive 
amplifier, for collective and individual attacks. The 'perfect' 
curve corresponds again to a perfect heterodyne detector (77 = 
1, v c i — 0) and no amplifier. The amplifier can be either 
optimal (N — 1, dashed lines), or realistic (iV = 1.5, full 
lines). 



SNR (see figure 4 in [14]). For optimization purposes, we 
have approximated this dependence with the following 
analytical function: 



log(l + SNR ) 
1.29 log(l + SNR) 



0.02 



(30) 



This function reflects the fact that high reconciliation 
efficiency can be achieved when working at high SNR, 
while operating the system at lower SNR values results in 
a lower reconciliation efficiency. In the SNR range [0.5;15] 
that we are using, (3 is an increasing function of SNR, 
while the maximal available secret key rates J . R — J BE 
or I AB — Xbe are decreasing functions of SNR [32]. In 
order to extract the optimal secret key generation rate 
at a given distance, it is therefore necessary to realize a 
non-trivial optimization with respect to the SNR. 

The simulation results are shown in figures [3] and 0] 
for the two cases presented in section UlI B[ respectively. 
We observe that in both cases the effect of the amplifier 
on the system performance may have a different scale 
but is essentially the same for collective and individual 
attacks. Furthermore, the larger the amplification gain 
the more pronounced this effect is, while in the case of a 
phase-insensitive amplifier an additional noise naturally 
degrades the secret key generation rate. 

A close examination of the modified detection-added 
noise expressions derived in section IIII Bl can facilitate 
the interpretation of the results. More specifically, start- 
ing from ([2TJ)) for the case of homodyne detection with 
a phase-sensitive amplifier, we observe that in the limit 
of large amplification gain this expression tends to zero. 
Therefore, an ideal phase-sensitive amplifier can compen- 
sate for all the imperfections of a practical homodyne 



FIG. 5: Secret key generation rate as a function of distance 
for protocols with homodyne detection and an ideal phase- 
sensitive amplifier with gain g = 20, and heterodyne detection 
and an ideal phase-insensitive amplifier with gain g — 20 
and noise N = 1, in the case of collective (main figure) and 
individual (inset) eavesdropping attacks. 



detector, that is from a system perspective their com- 
bination is equivalent to a perfect detection apparatus. 
Indeed, figure [3] shows that for large g the secret key gen- 
eration rate approaches that of the corresponding perfect 
detector curve. 

For heterodyne detection with a phase-insensitive am- 
plifier, the expression of (j2"5|) that applies to this case 
tends to N in the limit of large gain. We can see 
then that the combined amplifier and practical detec- 
tor can be equivalently described by a noiseless hetero- 
dyne detector featuring a limited efficiency r/, such that 
[1 + (1 — rj')]/r)' = N. As we discussed in section UlI Al 
for an ideal phase-insensitive amplifier, N = 1, which 
leads to an equivalent detector efficiency 77' = 1. There- 
fore, an ideal phase-insensitive amplifier can compensate 
for all the imperfections of a practical heterodyne detec- 
tor, exactly in the same way that an ideal phase-sensitive 
amplifier does for a homodyne detector. In a sense, the 
phase-insensitive amplifier precompensates for the inher- 
ent loss due to the beamsplitter of the heterodyne detec- 
tor. Their combination simulates then a perfect detection 
apparatus, as shown in figure |U Clearly, the effect of a 
more realistic amplifier with N > 1 on the system perfor- 
mance depends on the value of this noise. For the specific 
detector parameters that we are considering, this effect 
becomes negative when the noise exceeds 2.5Nq. 

From a practical point of view, it is also interesting to 
directly compare the performance of the homodyne and 
heterodyne protocols in the configurations previously dis- 
cussed. In figure Owe perform this comparison for ideal 
amplifiers with gain g = 20. We observe that, despite 
the improvement due to the presence of the amplifier, 
the heterodyne protocol is in general more vulnerable to 
system imperfections than the protocol with homodyne 
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detection, under the realistic assumptions we consider in 
this work. The superior performance of the homodyne 
protocol is especially pronounced in the case of collective 
attacks. 



IV. CONCLUSION 

In this paper, we have studied continuous-variable 
quantum key distribution protocols that use Gaussian 
modulation of coherent states for key encoding and em- 
ploy homodyne or heterodyne detection techniques. In 
particular, based on an equivalent entanglement-based 
scheme for this type of protocols, we reviewed the se- 
curity of the homodyne protocol against individual and 
collective eavesdropping attacks, and provided a secu- 
rity analysis for the heterodyne protocol. In all cases, 
we assumed that the eavesdropper does not have access 
to Bob's setup, and calculated the secret key generation 
rates for reverse reconciliation. Subsequently, we stud- 
ied the effect of adding a classical optical preamplifier 
at the output of the quantum channel and inside Bob's 
apparatus to the performance of the QKD system. To 
this end, we considered two types of amplifiers, an ideal 
phase-sensitive amplifier and a practical phase- insensitive 
amplifier, and derived the modified expressions for the 
secret key generation rate for the various configurations. 
We then applied these expressions to practical systems 
and compared the performance of such systems under 
realistic conditions. 

We find that an optimal phase-sensitive amplifier can 
compensate for all imperfections, such as losses and noise, 
of a practical homodyne detector, and an optimal phase- 
insensitive amplifier can do the same for a heterodyne 
detector, thus enhancing the performance of the corre- 
sponding CVQKD systems. Furthermore, our results 
show that realistic noisy amplifiers can also be employed 
in such systems with positive effects, as long as their noise 
does not exceed a certain value that depends on the de- 
tector parameters. For practical detectors and amplifiers, 
this condition is in general satisfied. It is therefore clear 
that overcoming the limitation imposed by the imper- 
fections of realistic detectors on the secret key rate of 
CVQKD systems is indeed possible using practical and 
well studied devices such as optical parametric amplifiers. 
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APPENDIX 

We provide here the modified secret key generation 
rates for the detector-amplifier configurations that 
were not discussed in section IIIIB1 namely the cases 
of homodyne detection with a phase-insensitive ampli- 
fier and heterodyne detection with a phase-sensitive 
amplifier. We also apply the results for these cases to 
practical systems and discuss the performance of the 
corresponding implementations. 

Homodyne detection and phase-insensitive am- 
plifier case: The analysis for collective attacks in this 
case is essentially the same as in the case of heterodyne 
detection with this type of amplifier, except for the ex- 
pression for 7 FoG of (fTB")) . which needs to include the ap- 
propriate value for v, and the expression of (|23[) . which 
is now written as 



7AIJFG — 7AIJFG <J AIJFGB 3 ^liom' T AIJFGB3 



(A31) 



In the above expression, H ham — (A7 B3 A) MP . Tak- 
ing into account these changes, we derive the symplectic 
eigenvalues A34 given in (fT5|) . (TTH]) . and A5,6,7 = 1. In this 
case as well, the effect of the phase-insensitive amplifier 
can be included in a modified detection-added noise: 



pia = (1 ~ V) + + N (9 ~ 1)?7 

Xhom 



(A32) 



Similarly to the cases presented in section IIIIB1 the 
mutual information of |T]) and the Shannon information 
bound of (|2|) remain the same, with the appropriate 
modification of x hom and % tot . 

Heterodyne detection and phase-sensitive am- 
plifier case: For a protocol with heterodyne detection 
when a phase-sensitive amplifier is added in the system, 
the analysis for collective attacks leads to the expressions 
of (|15p . (fT"7|) modified in one important way related to the 
fact that the amplifier's effect on the two quadratures is 
different. Since both quadratures are measured, this fact 
is taken into account by separately defining the modified 
detection-added noise for quadratures x and p as follows: 



PSA, IE 
Ahet 



1 + (1 - r{) + 2v Q 



Xhct 9 



9V 

1 + (1 - 77) + 2v e 



(A33) 



Then, the total noise is also correspondingly defined as 
Xtof = Xnnc + Xhet A ' X ' P /T, and (17]) becomes 



C' r 



1 



(A34) 



(T{V + X Z t )){T{V + X U) 

[Axl! t A ' x xZ A - p + B + i+ 

+ (xli A - x + x^ p ) (vVb + t(v + x,™)) + 

+2T (V 2 - 1)] 
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Dl 



T(V + X fJ 



T(V + xL) 



The mutual information and Shannon information 
bound of Q and ([4} are modified in a similar way. In 
particular, we now have 



V B = 



rjT 
r)T 

V 



l(v + xL)(v + xLW 



(A35) 



(Vx E 



1 



V V + x E 



I psa, a; 
~r Ahct 



1 



V + x E 



+ Y 

^ Ahet 



PSA,p 



where x E is given in section lll Bl and for example the last 
expression has been calculated from V B \ E = (^ B a j E ^ E ) 1,/2 
with 



v p , = 

b|e 



gjq ( Vx E + 1 
2 \ V + x E 
T]_ ( Vx E + 1 

25 



V + x E 



PSA, a; 

Ahet 



+ xL s t A ' p 



(A36) 



We then use the standard Shannon equations to derive 



lit and I£. 




10 20 30 40 50 60 70 80 

Distance (km) 



FIG. 7: Secret key generation rate as a function of distance 
for a protocol with heterodyne detection and a phase-sensitive 
amplifier, in the case of collective and individual attacks. The 
'perfect' curve corresponds to a perfect heterodyne detector 
(rj — 1, v cl — 0) and no amplifier. 



Application to practical systems: Figures O and [7] 
show the simulation results for the above cases, under the 
same conditions as the ones detailed in section lTlI CI Sim- 
ilarly to the case of heterodyne detection with a phase- 
insensitive amplifier, the expression of (|A32|) for homo- 
dyne detection with this type of amplifier tends to N 
in the limit of large gain. In this case, however, the 
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efficiency of the equivalent noiseless homodyne detector 
satisfies the relationship (1 — r]')/rj' = N, hence N = 1 
leads to 7/ = 0.5. Therefore, even for this optimal sce- 
nario, introducing such an amplifier actually degrades the 
QKD system performance, unless the homodyne detec- 
tor is untypically noisy and lossy. This negative effect is 
illustrated in figure [SI The case of heterodyne detection 
with a phase-sensitive amplifier is more subtle, because 
of the asymmetry expressed in (|A33[) . The effect of intro- 
ducing an amplifier in this case entirely depends on the 
system parameters, and is positive for the parameters of 
figure [71 



FIG. 6: Secret key generation rate as a function of distance for 
a protocol with homodyne detection and a phase-insensitive 
amplifier, for collective and individual attacks. The 'perfect' 
curve corresponds again to a perfect homodyne detector (r/ = 
1, ii c i = 0) and no amplifier. The amplifier can be either 

optimal (TV = 1, dashed lines), or realistic (N = 1.5, full REFERENCES 
lines). 
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